U.S. Department of Justice 



Federal Bureau of Investigation 

Washington, D.C. 20535 
August 25, 201 1 


MR. ERIK LARSON 


Subject: PTECH, INC. 
FOlPANo. 1160974-000 


Dear Mr. Larson: 


The enclosed documents were reviewed under the Freedom of Information/Privacy Acts (FOIPA), Title 5, 
United States Code, Section 552/552a. Deletions have been made to protect information which is exempt from disclosure, 
with the appropriate exemptions noted on the page next to the excision. In addition, a deleted page information sheet was 
inserted in the file to indicate where pages were withheld entirely. The exemptions used to withhold information are marked 
below and explained on the enclosed Form OPCA-16a: 

Section 552 


Section 552a 

8(b)(1) 

8(b)(7)(A) 

□(d)(5) 

□(b)(2) 

□(b)(7)(B) 

°0)(2) 

□(b)(3) 

8(b)(7)(C) 

□(k)(1) 


□(b)(7)(D) 

□(k)(2) 


□(b)(7)(E) 

□(k)(3) 


□(b)(7)(F) 

□(k)(4) 

□(b)(4) 

□(b)(8) 

□(k)(5) 

□ (b)(5) 

□(b)(9) 

□(k)(6) 

B(b)(6) 


□(k)(7) 


90 page(s) were reviewed and 62 page(s) are being released. 

e Document(s) were located which originated with, or contained information concerning other 
Government agency(ies) [OGA]. This information has been: 

□ referred to the OGA for review and direct response to you. 

b referred to the OGA for consultation. The FBI will correspond with you regarding this 
information when the consultation is finished. 

□ In accordance with standard FBI practice, this response neither confirms nor denies the 
existence of your subject's name on any watch lists. 

b You have the right to appeal any denials in this release. Appeals should be directed in writing to the 
Director, Office of Information Policy, U.S. Department of Justice, 1425 New York Ave., NW, 

Suite 11050, Washington, D.C. 20530-0001. Your appeal must be received by OIP within sixty (60) days 
from the date of this letter in order to be considered timely. The envelope and the letter should be clearly 
marked “Freedom of Information Appeal.” Please cite the FOIPA Number assigned to your 
request so that it may be easily identified. 



□ The enclosed material is from the main investigative file(s) in which the subject(s) of your request was 
the focus of the investigation. Our search located additional references, in files relating to other 
individuals, or matters, which may or may not be about your subject(s). Our experience has shown, 
when ident, references usually contain information similar to the information processed in the main file(s). 
Because of our significant backlog, we have given priority to processing only the main investigative file(s). 
If you want the references, you must submit a separate request for them in writing, and they will be 
reviewed at a later date, as time and resources permit. 

b See additional information which follows. 


Sincerely yours, 


David M. Hardy 
Section Chief 
Record/Information 
Dissemination Section 
Records Management Division 


Enclosure(s) 


In response to your Freedom of Information Act (FOIA) request, enclosed is a processed copy of FBI 
Headquarters file 288B-HQ-1 394667 and FBI Boston Field Office file 288B-BS-90939. 


EXPLANATION OF EXEMPTIONS 


SUBSECTIONS OF TITLE 5, UNITED STATES CODE, SECTION 552 

(b)(1) (A) specifically authorized under criteria established by an Executive order to be kept secret in the interest of national defense or foreign 

policy and (B) are in fact properly classified to such Executive order; 

(b)(2) related solely to the internal personnel rules and practices of an agency; 

(b)(3) specifically exempted from disclosure by statute (other than section 552b of this title), provided that such statute(A) requires that the 

matters be withheld from the public in such a manner as to leave no discretion on issue, or (B) establishes particular criteria for 
withholding or refers to particular types of matters to be withheld; 

(b)(4) trade secrets and commercial or financial information obtained from a person and privileged or confidential; 

(b)(5) inter-agency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation 

with the agency; 

(b)(6) personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy; 

(b)(7) records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement 

records or information ( A ) could be reasonably be expected to interfere with enforcement proceedings, ( B ) would deprive a person 
of a right to a fair trial or an impartial adjudication, ( C ) could be reasonably expected to constitute an unwarranted invasion of personal 
privacy, ( D ) could reasonably be expected to disclose the identity of confidential source, including a State, local, or foreign agency or 
authority or any private institution which furnished information on a confidential basis, and, in the case of record or information compiled 
by a criminal law enforcement authority in the course of a criminal investigation, or by an agency conducting a lawful national security 
intelligence investigation, information furnished by a confidential source, ( E ) would disclose techniques and procedures for law 
enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such 
disclosure could reasonably be expected to risk circumvention of the law, or ( F ) could reasonably be expected to endanger the life or 
physical safety of any individual; 

(b)(8) contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for 
the regulation or supervision of financial institutions; or 

(b)(9) geological and geophysical information and data, including maps, concerning wells. 

SUBSECTIONS OF TITLE 5, UNITED STATES CODE, SECTION 552a 

(d)(5) information compiled in reasonable anticipation of a civil action proceeding; 

(j) (2) material reporting investigative efforts pertaining to the enforcement of criminal law including efforts to prevent, control, or reduce 

crime or apprehend criminals; 

(k) ( 1 ) information which is currently and properly classified pursuant to an Executive order in the interest of the national defense or foreign 

policy, for example, information involving intelligence sources or methods; 

(k)(2) investigatory material compiled for law enforcement purposes, other than criminal, which did not result in loss of a right, benefit or 

privilege under Federal programs, or which would identify a source who furnished information pursuant to a promise that his/her identity 
would be held in confidence; 

(k)(3) material maintained in connection with providing protective services to the President of the United States or any other individual pursuant 
to the authority of Title 18, United States Code, Section 3056; 

(k)(4) required by statute to be maintained and used solely as statistical records; 

(k)(5) investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian 
employment or for access to classified information, the disclosure of which would reveal the identity of the person who furnished 
information pursuant to a promise that his/her identity would be held in confidence; 

(k)(6) testing or examination material used to determine individual qualifications for appointment or promotion in Federal Government sendee the 
release of which would compromise the testing or examination process; 

(k)(7) material used to determine potential for promotion in the armed services, the disclosure of which would reveal the identity of the person 
who furnished the material pursuant to a promise that his/her identity would be held in confidence. 


FBI/DOJ 


FEDERAL BUREAU OF INVESTIGATION 
FOIPA 

DELETED PAGE INFORMATION SHEET 
Serial Description ~ COVER SHEET 08/24/2002 
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Page 
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Page 
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Deleted Page(s) ~ 28 

2 ~ Duplicate 

3 ~ Duplicate 
4~ Duplicate 

5 ~ Duplicate 

6 ~ Duplicate 

7 - Duplicate 

8 - Duplicate 

9 ~ Duplicate 

10 ~ Duplicate 

11 ~ Duplicate 

12 ~ Duplicate 

13 ~ Duplicate 

14 ~ Duplicate 

15 ~ Duplicate 

16 ~ Duplicate 

17 ~ Duplicate 

18 - Duplicate 

26 ~ Duplicate 

27 ~ Duplicate 

28 ~ Duplicate 

29 ~ Duplicate 

30 ~ Duplicate 

31 ~ Duplicate 

32 ~ Duplicate 

33 ~ Duplicate 

34 ~ Duplicate 

35 ~ Duplicate 

36 ~ Duplicate 
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X No Duplication bee X 
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DECLASSIFIED BY 60324 UCBAU/SAB/SBS 
ON 06-23-2011 


(Rev. 01-31-2003) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


To: Boston 


Counterterrorism 


Date: 09/3/2003 


Office of Public Affairs 


Attn : 


Attn: 


Attn: 


SSA| 

sal 

saT 

ssaT" 

cca r 

co nJjs 11/rrc 

SC 1 

TFO S. room < 
SSAp "" 

Congressionc 
Room 7240 


(CT-3 ] 


1 (CT-1) 

. , room 5270 


From: Cyber 

CIS/C3IU/room , 

Contact: SSA 


Approved By: 


Drafted By: 
Case ID # : 


M l 1 -CLASS (Pending) 

288B-BS-90939 (Closed) 
288B-HQ-1394 667 (Closed) 


Title: C&k | | 

DBA, PTECH, INC., 

QUINCY, MASS. 

AOT - IT - WCC 

Synopsis: To provide receiving offices with (1) a copy of a 

White Paper regarding PTECH Inc., and (2) a letter addressed to 
Senator Charles Grassley, both prepared by Carnegie Mellon 
University CERT (computer incident response team) . 


(U) 


Derivi 

Decla 


Enclosures:-' (X) Enclosed for receiving offices is one (1) copy 
of a document entitled, "White Paper: Possible Terrorist Links 
To Ptech, Inc., a U.S. Company", prepared by Carnegie Mellon 
CERT, and (2) copy of a letter addressed to Senator Grassley from 
Carnegie Mellon CERT (not dated) . 


SE£RET^ 




SEijJJET 

Boston From: Cyber 

-{StJ 2 65C-BS- 908 61-CLASS , 09/3/2003 


Details: (U) Reference Boston EC to Coun terterrorism dated 

7/23/2003, and telcall s between SSA [ C3IU/CyD, SA | | 

Boston, and SSA t ITOS/CTD. 

For the informa tion of receiving offices, on 

8/12/2003, A/Scl |(U.S. Secret Service detailee to 
the Cyber Division, FBIHQ) , Computer Intrusion Section (CIS), 
obtained the enclosed White Paper fro m the US SS congressional 
affairs office, Washington D.C. A/SC l l advised that the 

document was prepared by the CERT, Carnegie Mellon University, 
Pittsburgh, PA. pursuant to a request from Senator Charles 
Grassley's office thru USSS. He advised that CERT was requested 
to conduct technical analysis of Ptech software . in connection 
with Senator Grassley's inquiries into the possible threat posed 
by Ptech and its product/services due to its alleged connections 
to terrorist groups and individuals. He advised that Senator 
Grassley's office staff may be requesting a meeting with the FBI 
once the CERT reports are completed and provided to the FBI for 
review . 

■£&£ On 8/13/2003, through Cyber Division/CCIU and 

Pittsburgh Division liaison with Carnegie Mellon CERT, CERT 

provided a copy of a letter addressed to Senator Grassley from 
CERT. The letter was pursuant to Senator Grassley's request for 
the CERT to examine Ptech Inc. software for evidence of malicious 
code or "back doors." The letter also provided CERT's 
conclusions which in essence stated that the CERT's evaluation 
found no evidence of backdoors or other malicious code and that ^ 
"further evaluation of the software will not yield new insights. 
CERT advise that the letter was forwarded 

(U) In view of the above, C3lU/CyD will consider the 
referenced lead completed. 


LEAD (S) 


SEjSREjT 


2 



SE£Rj£T 

To: Boston From: Cyber 

t u > Re: (X 265C-BS-90861-CLASS, 09/3/2003 

Set Lead 1: (Info) 

BOSTON DIVISION 
AT BOSTON. MASSACHUSETTS 
(U) Read and clear. 

Set Lead 2: (Info) 

COUNTERTERRORISM 
AT WASHINGTON D.C. 

(U) Read and clear. 

Set Lead 3: (Info) 

OFFICE OF PUBLIC AFFAIRS 
AT WASHINGTON D.C. 

(U) Read and clear. 
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DATE: 06-23-2011 

CLASSIFIED BY 60324 UCBAW/SAB7 SBS 
REASON: 1.4 (C) 

DECLASSIFY OH: 06-23-2036 


FEDERAL BUREAU OF INVESTIGATION 


(Rev. 08-28-2000) 



Precedence: PRIORITY 


Date: 10/25/2002 


To: CYBER 


Attn: C3I U / CIS / #5931 

SSA I — . 


(U) 


(S) 


(S) 


From: Boston 

C-ll NIP, 

Contact: SA 


Approved By: 

Drafted By: 

Case ID #: (U) 288B-BS-90939 (Pending) 


kls 


Title; 


M 


PTECH INC - SUBJECT (A U.S. COMPANY) 
FBI, FAA, IRS,USAF, DOE, OTHER U . S . 
GOVERNMENT AGENCIES - POSSIBLE VICTIMS 
TARGETING THE NATIONAL INFORMATION 
INFRASTRUCTURE - COUNTERINTELLIGENCE/ 
COUNTERTERRORISM (TNII-CI/CT) 

OO: HQ 


Investigative update to CYBER Division SSA £ 

(U) £»$ 


Derived--Frgm^^ 

DeolaaslfyOnT 


■ TT i Adminis trative: £b$ Refe ren ce teleca ll between SSA[ 

^ a nd SSA[ 1 SA I ' l SaT Ion 10/25/2002. 


be 

b7C 


bl 


b6 

b7C 



bl 


ALL INFORMATION C0HTAIHED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 



i aujri 


CYBER From: Boston 

(U) 288B-BS-90939, 10/25/2002 


Details : The following information is being p rovided as an 

investigate update to CYBER Division SSA as of 

10/25/2002. The following investigative actions nave been 
completed : 


sa | [ has interviewed both Boston Division Case 

Agents and Counterterrorism Supervisors responsible for the on- 
going parallel investigations. The case agent involved in 199N 
BS-86457 and 199N-BS-86451 has received extensive NIPC training 
and is considered technically literate. No positive information 
was obtained. 


jo positive 


intormation was obtamec 










To: CYBER From: Boston 

Re: (U) 288B-BS-90939, 10/25/2002 

LEAD (s) : 

Set Lead 1 : 

CYBER 

AT WASHINGTON, DC 



DATE: 06-23-2011 
FBI INFO. 

CLASSIFIED BY 60324 UCBAN/SAB/SBS 
REASON: 1.4 (c) 

DECLASSIFY ON: 06-23-2036 

FEDERAL BUREAU OF INVESTIGATION 



Precedence: ROUTINE 



Date: 10/30/2002 

To: Counterterrorism 

Attn : 

SSA 





UBLU , 

room 544 

8 

Boston 

Attn : 

SSA 






Cyber 

Squad 



Attn : 

ssa[ 



| 



CT Squad 


General Counsel 

Attn : 




] 


NSLU , room 7975 


From: Cyber 

CIS/C3IU | 

Contact: SSA 


Approved By: 


Drafted By: 


asm 


Case ID #: \S / 288B-HQ-1394 667 (Pending) 

(U) (V; i ~| (Pending) 

(A) 288B-BS-90939 (Pending) 


Title-: -)S5$ PTECH INC. - SUBJECT (U.S. COMPANY); 

(U) FBI, FAA, IRS, USAF, DOE, OTHER U.S. 

GOVERNMENT AGENCIES - POSSIBLE VICTIMS; 
TARGETING THE NATIONAL INFORMATION 
INFRASTRUCTURE - COUNTERINTELLIGENCE/ 
COUNTERTERRORISM (TNII-CI/CT) 


(S) 


Synopsis: Submission of 90 day LHM fo r captioned USPER Full 

r-i ^ i h t mmct- MT~n Hn a nn 11/97/200? I 


b7A 


bl 


(U) 


Deri^ed'-E^pm^.^^G-'-S' 

Declassarf^On'?---^^ 


(U) Full Field Investigation Instituted: 08/23/2002 



To 

Re 


Counterterrorism 


From: 



£83 28 8B- HQ- 13 94 667 , 10/30/2002 


Enclosure (s) : Original and one (1) copy of an LHM 

concerning status of captioned investigation to date. 

Details-: {&£ Captioned FI was predicated on the 

Counterterrorism Division's (CTD) investigations of individuals 
with connections to international terrorism organizations and 
activities, and their connection to a computer software company 
named Ptech Inc., Boston, MA. One of the main focuses of the CT 
investigation is the individuals' association with organizations 
and business establishments suspected of funding terrorist groups 
and activities. Additionally, during 8/2002, it was determined 
that the FBI had acquired and was currently using a ' Ptech Inc. 
software product for use in connection with the FBI intranet 
system as a management tool. 

The captioned TNII-CI/CT investigation was 

initiated for the purpose of determining Ptech 's possible 
involvement in the planting of malicious or unauthorized code in 
their software thereby threatening the compromise of U.S. 
computer networks, including U.S. government computer systems. 
Ptech Inc. internet company web site has advertised their 
customer list to include the FBI, FAA, IRS, USAF, DOE and other 
government agencies. In view of the previous CTD ongoing 
investigations of individuals associated with Ptech Inc., the 
captioned TNII-CI/CT investigation initiated by the Cyber 
Division (C3IU) is in support of the CTD investigations, to 
primarily provide CTD with technical support and guidance. 


In view of its supportive role to the CTD 

investigations, close coordination of parallel investigative 
efforts is being conducted at both the field and HQ levels. 
Additionally, the Boston Division CT and Cyber squads are 
coordinating their investigations of Ptech Inc. and the 
individuals associated with the company. 


To date, preliminary technical analysis of the FBI 
purchased Ptech software and of computers loaded with the 
software, have not revealed any. abnormalities or evidence of 
malicious or unauthorized code. 


reports, in terviews, ahd drnsf invatj LiydLlVb 

results, have been negative for any evidence of Ptech Inc.'s 
involvement in the planting of malicious or unauthorized code in 
their software or otherwise engaging in activities that pose a 
threat to U.S. computer networks. 





(U) 


To: 

Re: 




Counterterrorism From: Cyber 

288B-HQ-1394667, 10/30/2002 


LEAD (s) : 

Set Lead 1 : 


BOSTON 

AT BOSTON, MASSACHUSETTS 
(U) Read and clear. 

Set Lead 2 : 

COUNTERTERRORISM 

AT WASHINGTON. DC 
US AM A. BIN LADEN UNIT (UBLU) 
(U) Read and clear. 


Set Lead 3: 

CF.NF.RAL COUNSEL 

AT WASHINGTON. DC 


(S) 



♦♦ 



4 



(Rev. 08-28-2000) 



DATE: 06-23-2011 

CLASSIFIED BY 60324 UCBAW/SAB/SBS 
REASON: 1.4 (c) 

DECLASSIFY ON: 06-23-2036 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Counterterrorism 

Cyber 


Date: 11/07/2002 


Attn: SSA 

UBLlT; room 044 B 


Attn: SSA I 

CIS/C3IU 


Boston 


Attn : 


SSA |_ 
CT-1 
SS£[. 


CT-3 



b6 

b7C 


General Counsel 


Attn : 

NSLU , room m~5 


From: Boston 

C-ll 

Contact : 


CSFE 


Approved By: 
Drafted By: 


Jss 



3RRR-BS-90939 


288B-BS-90939 

199N-BS-86451 

199N-BS-86457 

288B-HQ-1394667 


( Pending) 
{ Pending) 
(Pending) 
(Pending) 
(Pending) 
{ Pending) 


b7A 


(I n Title: PTECH INC. -SUBJECT (U.S. COMPANY); 

' ' FBI, FAA, IRS, USAF, DOE, OTHER U.S. 

GOVERNMENT AGENCIES - POSSIBLE VICTIMS; 
TARGETING THE NATIONAL INFORMATION 
INFRASTRUCTURE - COUNTERINTELLIGENCE/ 
COUNTERTERRORISM (TNII-CI/CT 

SJJPRST 


ALL INF0RHATI0N CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 









To: Counterterrorism 

Re: £SQ 288B-BS-90939 


From: Boston 

11/07/2002 



To: Counterterrorism 

Re: X) 2 8 8B-BS- 90 93 9 




From: Boston 

11/07/2002 







To: Counterterrorism From: Boston 

Re: 288B-BS-90939 11/07/2002 

LEAD (s) : 

Set Lead 1 : 

BOSTON 

AT BOSTON. MASSACHUSETTS 
(U) Read and clear. 

Set Lead 2 : 

COUNTERTERRORISM 

AT WASHINGTON. DC 
USAMA BIN LADEN UNIT (UBLU) 
(U) Read and clear. 

Set Lead 3 : 

CYBER 

AT WASHINGTON. DC 
CIS/C3IU 

(U) Read and clear. 


♦♦ 



(Rev. 08-28-2000) 



DATE: 06-23-2011 

CLASSIFIED BY 60324 UCBAW/SAB/SBS 
REASON: 1.4 (c) 

DECLASSIFY ON: 06-23-2036 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Cyber 

Boston 


Counterterrorism 


Date: 11/15/2002 


Attn : 


cis /cinn 
SSA 
CT- 
SSA 
CT 
SA 

CT-3I 
SaF^ 


CT-1 

SSA 

UBLuJ room 544£ 


b6 

b7C 


(U) 


From: Boston 

C-ll 

Contact : 


Approved By: 
Drafted By: 

Case ID #: O&Q 


S] o 


288B-BS-90939 (Pending) 


Title: (M PTECH INC. -SUBJECT (U . S . COMPANY ) ; 

FBI, FAA, IRS, USAF, DOE, OTHER U.S. 
GOVERNMENT AGENCIES - POSSIBLE VICTIMS; 
TARGETING THE NATIONAL INFORMATION 
INFRASTRUCTURE - COUNTERINTELLIGENCE/ 
COUNTERTERRORISM (TNII-CI/CT) 


(U) 


Synopsis: ££) 

agent 


To report current investigative action by case 


jtti £§<( DerrvSdHPromj_ G — 3 



bl 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 








To: Cyber From: Boston 

Re: (>&£) 288B-BS-90939, 11/15/2002 


LEAD (s) : 

Set Lead 1 : 

BOSTON 

AT BOSTON, MASSACHUSETTS 
(U) Read and clear. 

Set Lead 2 : 

COUNTERTERRORISM 

AT WASHINGTON. DC 
(U) Read and clear. 

Set Lead 3 : 

CYBER 

AT WASHINGTON. DC 

CIS/C3IU 

(U) Read and clear. 


♦♦ 



(Rev. 08-28-2000) 


ALL INFORMATION CONTAINED 

HEREIN IS UNCLASSIFIED 

DATE 06-23-2011 BY 60324 UCBAW/SAB/SBS 


FEDERAL BUREAU OF INVESTIGATION 


Precedence : 

To: Boston 

From 


ROUTINE 


Date: 12/12/2002 


Boston 

Hudson RA 

Contact : SA 


Approved By: 
Drafted By: 


3 jat 


Case ID #: 288B-BS-90939 (Pending) 

199N-BS-77139 (Pending) 

Title: P-TECH 

Synopsis: On 12/12/2002, an anonymous telephone call was 

received from a female providing information about P-TECH. 

Rflhfrnm " °u 12/ } 2/ 2 J? 02 > an anonymous female contacted the Hudson 
?? f ^ J phone booth. She refused to identify herself. She 
tated the information was from personal knowledge. 


1 She stated 
Jwas I 


of Canton, MA, telephone!" 
!ZJat P-TECH in 2000. 


She bel i eves I 


J was [ 


3 


] 


HUDSON went out of business in June 2002 


_ was associated with 

HE ALY HUDSON of 101 Federal Street. 

]was an employee. HEALY 


and 


c 


1 1 WINCHESTER, MA, telephone P ~ 

Jnow of OCCHSLE INTERNATIONAL ADVISORS, Boston, MA^E^V 

P UI?7\TV TTrinnA-ki r 


also have worked at HEALY HUDSON, 
investigating SeSP in£ormati ° n be helpful to those 

recontact nSmbfr^ 3611 t0 identify herself and provided no 


b6 

b7C 




(Rev. 08-28-2000) 



DATE: 06-23-2011 

CLASSIFIED BY 60324 UCBAW/SAB/SBS 
REASON: 1.4 (c) 

DECLASSIFY OH: 06-23-2036 


FEOERiL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Boston 

CYBER 

From: CYBER 

STAS/TAU/Room 

Contact: SSA 


Date: 01/02/2003 



Approved By : [ 
Drafted By: £ 


tbf 


b 6 
b7C 


Case ID #: (U) 288B-BS-90939 (Pending) 

(U) 66F-HQ-C1319773 (None) 

Title: ^ PTECH INC. - SUBJECT (A U.S. COMPANY) 
FBI, FAA, IRS, USAF, DOE, OTHER U.S. 
GOVERNMENT AGENCIES - POSSIBLE VICTIMS 
TARGETING THE NATIONAL INFORMATION 
INFRASTRUCTURE- COUNTERINTELLIGENCE/ 
COUNTERTERRORISM (TNII-CI/CT) 

OO: HQ 


(S) 



J§S5C SE'tf' 


ALL INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 








/NOFORN/ORCON 



U.S. Department of Justice 


Federal Bureau of Investigation 


DATE: 06-23-2011 
FBI INFO. 

CLASSIFIED BY 60324 UCBAN/SAB/SBS 
REASON: 1.4 (c) 

DECLASSIFY ON: 06-23-2036 


Washington. D. C. 20535-0001 


April 2, 2003 


(U) 


c , nT PTECH INC. - SUBJECT (U.S. COMPANY); 

FBI ' FAA, IRS, USAF, DOE, OTHER U.S. GOVERNMENT AGENCIES 

POSSIBLE VICTIMS; 

TARGETING THE NATIONAL INFORMATION INFRASTRUCTURE - 
COUNTERINTELLIGENCE/COUNTERTERRORISM (TNII-CI/CT) 

FILE #288B-HQ-1394 667 


(U) 


(U) 



(U) Full Field Investigation instituted: 8/23/2002 

^ U j £8(5 Dertved^Fr om j 

Since June 1995, the Boston FBI Counterterrorism 

(CT) squads have been investigating several individuals who have 
had numerous contacts and associations with persons and groups 

suspected of ties t o international terrorism. Some of th P Q P 

individuals include T 


are associated, as described below, 

Quincy, Massachusetts, a computer 


witn Ptech Inc. 

software company. Source reporting and the Ptech Internet' 
website have listed the FBI, FAA, IRS, USAF, DOE, and other U.S. 
government agencies as Ptech customers. Source information has 
also reported that Ptech may have done business with the White 
House and/or the Vice President's office, under the auspices of 
another company named Process Renewal Group (PRG) . 

r . Ptech Inc. is a business involved in providina 

enterprise architecture and business modeling, analysis and 

solutlons to Global 2000 companies. This technology 
addresses every aspect of the organization, from strategic 
planning, to business architecture; from business processes to 
network, supporting applications, and all forms of information, 
which is integrated to form a complete representation of the 

3 knowled 9 e - Massachusetts State corporate records list 
tech Inc. as a partnership, its business address as T fin FpHprai 
Street, Boston. MA. n?1in. %nH u-.l > I * CF 


as 

The 


a i n o 

S/vmqqR 1 " 1 ^ 1 xe£ erences an involuntary dissolution date of 
o/ji/iyyy, and a subsequent revival date of 6/1/2001 
Lexis/Nexis checks of Ptech list the company's other 'principals 




/NOFORN/ORCON 


b6 

b7C 



J§|3SRldyNOFORN/ORCON 


(U! 


(U) 


(U) 


(S) 


as 


I 


and 


tu> 


inquiry 


On 6/27/1995, FBI Boston opened a preliminary 
(PI) on| J based on his telephone contacts with the 


Holy Land Foundation for Relief and Development (HLFRD) , Dallas, 
Texas. HLFRD is an organization suspected of being a source for 
funding terrorist activities and groups. 

(X/NF/OC) Investigation of f~ 

that he had telephone contacts with | j 

associated with other Boston international terrorism subjects. 

A Full Field Investigation ( FFI ) (199N-BS-77139) was initiated by 
FBI Boston on 6/11/2002. 


had also revealed 
[subjects and was 


and 


Source information has indicated that 

other Ptech employees traveled to Saudi Arabia, durina Februarv 
1999, to seek funding fr om a wealthy Saudi Arabian name I 

J. Sources have also reported that I I 


may have been the source of approximately $16 million in startup 
funds for Ptech. | I has been described as one of the "chief 
money launderers" for OSAMA BIN LADEN. 


Source rep orting has indicat ed that another 

is associated with! and Ptech. 


M 

indivi dual,! 

I l is repor ted to be a Pakistani Nationar^on the Ptech Board 

of Directors. I l is also the head of SAAR Foundation, 

Herndon, VA. This foundation has been linked to financial 
organizations that are being investigated for handling large sums 
of money to fund activities for OSAMA BIN LADEN and various other 
terrorist organizations. SAAR is the subject of a U.S. Customs 
Service (USCS) /Joint Terrorism Task Force ( JTTF) case. I — l is 

a central figure in this investigation. Searches of the offices 
of SAAR Foundation, and other foundations in the Northern 
Virginia area, were conducted by federal agents during March 
2002, in connection with the USCS/JTTF investigation. 


C&/NF/OC) [ 


a U.S. person, is 


employed as a computer software engineer for Ptech. | ' lalso 

serves as the current president and as a long-time member of CARE 
INTERNATIONAL, a . non-governmental organization in Boston with 
ties to international t erroris m and as a source of funding for 


terrorist activities. 
_J199N-BS-Rfi4S7^ / 


is the subject of a FBI Boston FFT 


/ This investigation has revealed that CARE 

INTERNATIONAL serves as a front for recruiting local Muslims to 
participate in international jihad effort. 


1 


s^s^rlv> 


/NOEORN/ORCON 
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IT/NOFORN/ORCON 


(U) 


(U) 


>^/NF/OC) 


Inc., in Boston, and is the I 

International, a non-governmental organization in Boston~with 


is an employee of Ptech 
] of Care 


ties to international terrorism. Care International was 
previously known as the Al-Kifah Refugee Center of Boston. 
Following the World Trade Center attack 'in 1993, Al-Kifah changed 
its name to Care International after the media reported that 
members of the Al— Kifah Refugee Center of New York were involved 
in the attack. In the Boston area, Care International has served 
as a front for recruitinq/fundin q local Mus lims to participate in 
the international — Jihad efforts. I~ — . lis closely associated 

with l lof Care International. 

On May 28, 2002, a complainant working for JP 
Morgan Chase in Manhattan, NY, reported suspicious business 
practices by Ptech. This complainant was concerned that Ptech 
was involved in the theft of technology fr om U.S. companies. 

This complainant advised thatf 1 ' 


7 i is connected to 

organizations which provide funding for terrorist purposes. 


This 


- 1 — VW t 

complainant further indicated that a Ptech employee may have 
tried to gain access to the Chase network during a demonstration 
of Ptech products and/or services, although there is no 
independent information to corroborate this. 


On August 23, 2002, it was determined that the 

Information Resources Management (IRM) Office, FBIHQ, had 
purchased Enterprise Architecture computer software from Ptech in 
early 2001. This software, named "Framework," was being used as 
a management tool for the FBI ' s intranet network and is used for 
the FBI Enterprise Architecture project. The software allows 
users to access the FBI's Strategic Plan, organization chart, 
business processes, and other applications. 


Ptech Framework software originals and copies 
including updated versions and "accelerators" were provided to 
the Counterintelligence Counterterrorism Computer Intrusion Unit 
(C3IU) , Cyber Division, by IRM for technical analysis. Technical 
analysis of the Ptech software by the Special Technologies and 
Applications Section (STAS) to date has not revealed any evidence 
of malicious (eg. trojans, backdoors, viruses, worms, etc.) or 
any other unauthorized code imbedded in the software. 

Examination of two IRM computers used to run the software has 
not revealed any abnormalities. According to IRM, the Ptech 
software was not used to connect to the FBI computer network. 


(S) 
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(U) 


(U) 


(U) 


(U) 


^)S^X|NOFORN/ORCON 


Referral/ Consult 


^ f RM personnel (section chief, chief architect 
computer scientist, contractors) who worked with the Ptech 
software on the FBI Enterprise Architecture project have been 
interviewed These individuals had no direct contacts or 
dealings with Ptech or its personnel with the exception of 

fh«? 1 ?i! 9 pJ ra i nin ?^ fr ° m instructors from Ptech. The reason is 
that the Ptech software purchased by the FBI was actually 

?nH C M Se ? through a government contractor called SPAWAR (Space 
and Naval Warfare) . The interviews did not indicate any unusual 
or suspicious activity on the part of Ptech or of the performance 
and operation of the Ptech software used by the FBI . 

_ C3IU has obtained documents from IRM and the 

Contracts Unit that relate to the FBI purchase of the Ptech 
software. The documents indicate that during 12/2001, the FBI 
purchased two licensed copies of the Ptech Framework software, 
u P d ? tes and accelerators, for use in developing the 
FBI s Enterprise Architecture (EA) at a cost of $15,000 The 
purchase was actually made by SPAWAR on behalf of the FBI and 
pursuant to the SPAWAR contract. 

. , ; The FBI New Y °rk Cyber squad has advised that they 
worked with the security department of JP Morgan Chase Bank, NY, 

To n ^ erning Ptec h's efforts to market their software to the bank. 
JP Morgan security advised that a Ptech representative was 
ToS Wed 1;L ^ dted access to the company's network for this purpose. 

Morgan Chase Bank security conducted a thorough search of all 
areas of their network accessed by the Ptech representative but 
did not find any abnormalities. They advised that during a Ptech 
software demonstration at JP Morgan Bank, JP Morgan denied the 
Ptech s representative's request to connect his computer with the 

Tp m M any S *}?twork. As a result of the above dealings with Ptech, 
JP Morgan did not purchase software from the company. 

& Source information and public records have 

indicated that the Process Renewal Group (PRG) is a consulting 
group out of Vancouver, Br itish Columbia, Canada. A former Ptech 
xnc. employee, | I was once employed by PRG. Source 

• J as „ turther indicated that PRG never had a contract 

S h H ? US k been cl , almed b y Ptech advertisements 

and is believed to be fabricated by | and others for the 

benefit of Ptech. rnu - - 


c ^ Th ? Contracts Unit, Finance Division, FBIHQ, 

with PRG^ hey failed to locate an Y records of doing business 
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T/NOFORN/ORCON 


(S) 


T he FBI Boston's ccunterterrnri qm 


i mraeti gation 

has not 


(U) 


to date, 

developed _uuj, luiuimdtiun or indications that Ptech has been 

J;^ 1Ved K in i^ he lnstallation of any malicious or unauthorized 
ode or backdoors into the FBI or other government networks, 
either through their software or services. 

Th ? FBI Boston Division Cyber squad has been 
orking closely with the Boston Counterterrorism squads to 
coordinate the investigations of Ptech and its principals. 
Boston s Cyber squad in conjunction with FBIHQ, has been 
coordinating their efforts to evaluate the extent and nature of 
tne threat to the national information infrastructure posed by 
Ptech Inc., its products/services, and its principals and 
employees. 


bl 


<S) 



(S) 


bl 


Posinve inrormacion was obtained . / ~ 


/No~ 


(S) 


(U) 


j no positive mrormation was obtained. 


IRM conducted a canvass of all FBI divisions to 
if any other Ptech products were being used or had been 
The results °f f he canvass determined that no one else 
F ~ I r fP° rted acquiring or using any Ptech products. IRM 
and the FBI has discontinued the use of the Ptech Framework 


determine 

acquired. 


SJ*^T/NOEORN/ORCON 
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^sfefi^f^OFORN/ORCON 


software and a decision has been made not to 
products in the future. 


acquire or use Ptech 


(S) 


(U) 


(S) 


(U) 


U 4 _ _ -ll ) — 1 ■ J No positive information concerning 

Possible implantation of malicious or unauthorized^ode 
in their software was discovered. 

Tn? — . : ^ Durin g November 2002, FBI Boston received source 

information concerning the source's knowledge of Ptech' s hnsinp« 
and products, and Ptecti U 1 Thp 

H:I 1Sed ^ that Ptech P roc * ucts are stand alone products, that is not 
esigned or meant to interface or operate directly on or with a 
customer s company network. According to the source,! I 

reS t^ te ^ P ut ^ in 9 the capabilities in the Ptech software that 
"°^ d al | ow 11: to interface with other software running on the 
customer s computer network. The source stated that the Ptech 
software was not designed with hidden bugs or viruses, nor could 
it be manipulated remotely by someone. In the opinion of the 
source, any such manipulation of the Ptech products would be 
obvious to and immediately rejected by its customers or users 



h ,y . Recently, the U.S. Customs Service conducted a 
highly publicized search of the Ptech offices in Boston, in 
connection with their terrorist related investigation of Ptech 
and some of its principles. The FBI has not received any 
information resulting from the Custom's search and Ptech 
investigation indicating any specific threat to the national 

and/or Services ltlCal infrastructures ' P°sed by Ptech software 

Pfprh . (U) The FB 5 das not received any information from any 

report S J® deral ac ? enc y °r anyone else, concerning l 

report of a specific threat or actual anomalous behavior 
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JS^Ci^VNOFORN/ORCON 


exhibited or detected resulting from the use of Ptech software 
or services. 

(U) Absent any specific information indicating a 
specific threat to the national security and u.S. information 
infrastructure posed by Ptech software and/or services, its 

principles and employees, no further investigation is warranted 
oy the FBI . 
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REASON: 1.4 (c) 

DECLASSIFY ON: 06-23-2036 


FEDERAL BUREAU OF INVESTIGATION 


(Rev. 01-31-2003) 



Precedence : ROUTINE 

To: Counterterrorism 

Boston 

General Counsel 


Date: 04/04/2003 


Attn : 

Attn: 
Attn: 
Attn : 


ssa 

IOS 

ITOS-1 /Conns T~ 
SSAl 


□ 


room 5432 


Cyber Son ad 
SSA | 

CT Squad 


NSLU, room 7975 


From: Cyber 

CIS/C3IU/room 5931 

Contact: SSA | 

Approved By : I 
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Drafted By: 


jtt. Case ID # : (\s; 288B-HQ-1394 667 (Closed) 

' ' (yO 2 65C-BS-908 61 (Pending) 

(o\ 2 8 8B-BS- 90 93 9 (Pending) 

(U) Title: PTECH INC. - SUBJECT (U.S. COMPANY); 

FAA, IRS, USAF, DOE, OTHER U.S. 
GOVERNMENT AGENCIES - POSSIBLE VICTIMS; 
TARGETING THE NATIONAL INFORMATION 
INFRASTRUCTURE - COUNTERTERRORISM/ 
COUNTERINTELLIGENCE (TNII-CT/CI) 


(S) 


Synopsis: ^ Submission of c losing LHM for captioned tispf.r 

Full Field Investigation (FFI) .1 

/ 

(U) DerTtyed~-E5^a : --r-^T? : ^ 

DeslaasXfyOHl 


bl 


(U) Full Field 


Investigation Instituted: 


08/23/2002 




To: 

Re 


Counterterrorism From: Cyber 

& 28 8B-HQ-1394 667 , 04/04/2003 


Enclosure (s) : £8$ Original and one (1) copy of an LHM 
concerning the status and basis for closing captioned case 


Details : £&£ Captioned FFI was predicated on the 
Counterterrorism Division's (CTD) investigations of individuals 
with connections to international terrorism organizations and 
aCtl Y 1 ^ es / and their connection to a computer software company 
named Ptech Inc., Boston, MA. One of the main focuses of the CT 
investigation is the individuals' association with organizations 
and business establishments suspected of funding terrorist groups 
fu d H . a ?5 1VltleS ' Addi tionally, during 8/2002, it was determined 
that the FBI had acquired and was currently using a Ptech Inc. 
software product for use in connection with the FBI intranet 
system as a management tool. 


. y&i The captioned TNII-CI/CT investigation was 

initiated for the purpose of determining Ptech's possible 
involvement in the planting of malicious or unauthorized code in 
their software thereby threatening the possible compromise of 
U.S. computer networks, including vital U.S. government computer 
systems. Ptech Inc. Internet company web site has advertised 
their customer list to include the FBI, FAA, IRS, USAF, DOE and 
other government agencies. The captioned TNII-CI/CT 
investigation initiated by the Cyber Division (C3IU) is in 
support of the CTD investigations relating to Ptech, to primarily 
provide CTD with technical support and guidance, and to fully 
investigate and assess the potential threat to the U.S. 
information infrastructure, if any, posed by Ptech, its 
products/services, and its principals and employees. 


; In view of its supportive role to the CTD 

investigations, close coordination of parallel investigative 
efforts was being conducted at both the field and HQ levels. 
Additionally, the Boston Division CT and Cyber squads are 
coordinating their investigations of Ptech Inc. and the 
individuals associated with the company. 


To date, prophylactic technical analysis of the 
FBI purchased Ptech software and of computers loaded with the 
software, have not revealed indicia of any abnormalities nr 
evidence of malicious or iinanthnri code, j 

' report^ — interviews, — source 


I w A- ^ f 111LC1 v_lc:wo, OUUiUt; 

■l cpui l -L iiy ana orner investigative results , have been negative for 
any evidence of Ptech Inc.'s involvement in the planting of 
malicious or unauthorized code in their software or otherwise 



!T 


To: Counterterrorism From: Cyber 

288B-HQ-1394667, 04/04/2003 


engaging in activities that pose a threat to U.S. computer 
networks. 


(S) 


Ref erral/ Consult 

(U) . In view of the above, CyD will discontinue any 

further investigation of the TNII-CT/CI matter, absent any 
indication of a specific threat posed by Ptech or its products 
and services to the U.S. information infrastructure. CyD will 
continue its technical support of the continuing CT investigation 
concerning individuals associated with Ptech. 
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IT 


(U) 


To: Counterterrorism From: Cyber 

Re : /£££ 288B-HQ-1394 667 , 04/04/2003 


LEAD (s) : 

Set Lead 1 : (Discretionary) 

BOSTON 

AT AT BOSTON. MASSACHUSETTS 

(U) For Boston Cyber Squad. C3IU recommends Boston 
close their parallel TNII-CT/CI matter when appropriate, in view 
of the closing of the FBI HQ case. ' 

Set Lead 2: (Info) 

COUNTERTERRORISM 


(S) 


AT AT WASH I NOTQN D.C. 

(U) For ITOS-l/Conus II. Read and clear. 

Set Lead 3 : (Action) 

GENERAL COUNSFT, 

AT WASHINGTON. DC 

X 


bl 


♦ ♦ 
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DATE: 06-23-2011 

SE^BBT7NOFORN/ORCON CLASSIFIED BY 60324 UCBAW/SAB/SBS 

N. REASON: 1.4 [c) 

\ - DECLASSIFY OH: 06-23-2036 


U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 
File No. 


Boston, 'MA 02108 
March 11, 2003 


X PTECH INC. - SUBJECT (U.S. COMPANY); 

FBI, FAA, IRS, USAF , DOE, OTHER U.S. GOVERNMENT AGENCIES - 

POSSIBLE VICTIMS; 

TARGETING THE NATIONAL INFORMATION INFRASTRUCTURE - 
COUNTERINTELLIGENCE/COUNTERTERRORISM (TNII-CI/CT) 

FILE #288B-BS-90939 


(U) Full Field Investigation instituted: 


(U) 


X 


Deriv^d-J££§pr''K-3 

Decl^si^yOns^X-l 


9/12/2002 


bl 


(S) 


s document contains neither recommendations nor conclusions of the FBI. It is the 
and is loaned to your agency; it andits extents are not to be distributed outside 


ALL INFORMATION CONTAINED ^JsCwE^/NOFORN/ORCON 

HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOOT OTHERWISE 


property of the 

your agency. 
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DATE: 06-23-2011 

CLASSIFIED BY 6C324 UCBAW/SAB/SBS 
REASON: 1.4 (C) 

DECLASSIFY OK: 06-23-2036 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 4/11/2003 



NSLU, room 7975 


From: Boston 



(U) Case ID # : 288B-BS-90939 (Pending) 

(U) Title: PTECH INC. -SUBJECT (U . S . COMPANY) ; 

FBI, FAA, IRS, USAF, DOE, OTHER U.S. 

GOVERNMENT AGENCIES - POSSIBLE VICTIMS; 
TARGETING THE NATIONAL INFORMATION 
INFRASTRUCTURE - COUNTERINTELLIGENCE/ 

COUNTER TERRORISM (TNII-CI/CT) 

(U) Synopsis: M Submission of closing LHM for captioned Full 

Field Investigation (FI) and request to close above captioned 
case. ^ 


(U) 

(S) 


(u) M 


DeriVed--E5^a-^^^§-^3 

Deolas«^nEy"^rr~^Xl. 


Enclosure (s) : Original and one (1) copy of an LHM 
concerning closing of above captioned case. 
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ALL INFORMATION C OBTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 





IT/ORCON/NOFOFN 


To: Cyber From: Boston 

R e: 288B-BS-90939, 4/11/2003 

LEAD (s) : 

Set Lead 1: (Info) 

CYBER 

AT WASHINGTON, nr 
(U) Read and clear. 

Set Lead 2: (Info) 

GENERAL COUNSEL 

AT WASHINGTON, nr 
(U) Read and clear. 

Set Lead 3: (Info) 

BOSTON 

AT BOSTON 

(U) Read and clear. 


♦♦ 


''l&psSws^/o 


ORCON/NOFORN 
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DECLASSIFIED BY 60324 UCBATJ/SAB/SBS 
ON 06-23-2011 


FEDERAL BUREAU OF INVESTIGATION 


(U) 

(U) 


Precedence: PRIORITY 


Date: 07/23/2003 


To: Counterterrorism 


Cyber 

Boston 


Attn : 


Attn : 
Attn : 


ITOS 

sspJ— 

iosf 

TF| 

SC 

ss 


1. /CONUS 

U 




1 


cis/ C3iU 

ASACr~““ 

SSA I 


2/ TEAM 6 


From: Boston 

CT-3 

Contact: SA 


Approved By: 


Drafted By: 


dd 


Case ID # 


IcLASS (Pending) 
288B-BS-90939 (Closed) 
288B-HQ-1394667 (Closed) 


Title : \ 

dba, PTECH, INC. , 
Quincy, Massachusetts; 
AOT - IT - WCC 


Synopsis: (U) Notify TFOS and CYBER of recent 
provided to Boston by the Bureau of Customs and 
Enforcement (BICE) . 


information 

Immigration 


(U) 


M 



ClassT 
Reason 
Declaesi 


T-3/Boston 


Detaiis: (U) On July 23, 2003, SSA I | B ICE Boston 

thrunited 1 statp° n q° f r f C ^ nt ^formation proffered to BICE, by 
tne United. States Secret Service (USSS) , Washington D C BIPF 

reqSestldrtSt USSS a PP are " tl y : Senator Charles Grassley's Office 
requested that USSS, Department of Homeland Securitv conduct- an 

independent review of the software sold by PTECH of Y Quincv 
Massachusetts in order to determine if i/repreLnteS a p^entia 

\ 

SE 
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To: Counterterrorism From: Boston 

M Re: 265C-BS-90861-CLASS, 07/23/2003 


Frfmework Ct ^L t ^nf? t ' PTECH ' S core software product is known as 
n ;*™ rk ' T ? e software is a strategic planning software 
product. Bo ston has only limited information at this time, 
however, SSA | | BICE, Boston indicated that the USSS 

pwputc ted witn an unnamed independent contractor to review 
ECH S product. Apparently this independent contractor's 

tha B PTECH 's product poses a potential threat 
to the US computer infrastructure. In addition, this + 
is suggesting th at 1 i . win xacror 


3 a f '"PTECTTJ may have duplicated hard drives ' of the 

t" pH m n Vo ^ 1 ^ nmnon . i 


fn V H Slted ° n , behalf ° f PTECH ' and then took th ese hard 
drives with him out of the country to Egypt. 

, , (C) The Assistant US Attorney in charge of the PTECH 

i! P»» allagltions an/Ja™ 


advised SSAf |of BICE that the USSS must produce their 

source and the related report so that the Boston investigative 
team can evaluate the information and follow up on it. 


(U) It should be noted that [ 


recently interviewed during the course of this investigation 
while he was on a short visit to the Boston area. I y | left 
Boston and is be lieved to be back in Egypt. There are 

August tl ?nn? t f at -t-k l may be returnin g to the Boston area in 

August, 2003 for rurt ner interv iew and possible Federal Grand 

Ea^ot^fth 111 -^' ■r ls °' [,.„ “ I operates a software company in 

Egypt with his wife. me tirm, known as HORIZONS, conducts 

p5;j! are testing for PTECH. At the founding of PTECH in 1994, 
om? CH assisted m obtaining funding by an entity known as 
BMI - 0n ^ of the principals of BMI at that time was' ’ 
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SECRET 

(U) To: Counterterrorism From: Boston 

Rc: M 2 65C-BS-90 8 61-CLASS, 07/23/2003 


LEAD (s) : 

Set Lead 1: (Info) 

COUNTERTERRORISM 

AT ITOS 1 /CONUS 2 /TEAM -6 
(U) Read and clear. 

Set Lead 2 : (Discretionary) 

CYBER 


AT CIS/C3TU 

(U) Liaise with TFOS and Boston regarding appropriate 
response when additional details become available. P 

Set Lead 3: (Action) 

COUNTERTERRORISM 
AT TFOS 

■ -p Obtain additional details regarding recent 

in ormation from BICE regarding USSS re view of PTECH product 
rough BICE, Deputy, | l assigned to TFOS. 

, Through liaison with USSS in Washington, D.C., 

obtain details concerning the examination of PTECH software 

nt?i'i 1 ^I5 g - an pK rep0rtS generated with the identity of any experts 
utilized m this process. 


b6 
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(Rev. 01-31-2003) 


ALL INFORMATION CONTAINED 

HEREIN 15 UNCLASSIFIED 

DATE 06-23-2011 BY 60324 UCBAW/SAB/SBS 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: Boston 


Date : 


08/14/2003 


Attn : 



From: Boston 

CT-3 

Contact: 


SA 


Approved By : | 
Drafted By: 


Case ID #: 




199N-BS-86451 
1 99N-BS-8 64 57 
288B-BS-90939 


dd 

( Pending) 
(Pending) 
( Pending) 
(Closed) 


Title : 


dba, PTECH, INC. , 
Quincy, Massachusetts' 


So?? 31 *' , Pr ° vide *ork Product of CERT Coorination Center regarding 
contents aminatl ° n ° f PTECH ' INC ' software and overview of their 


Enclosure (s) : One letter undated to Senator Charles Grasslev 

Company"^ entltled; " Possi ble Terrorist Links to Ptech, Inc. 


One 
a U.S 


On July 23, 2003, Boston was advised by SSaT 

rvm c* nnrl Tww A ~ ~ 4- 4 i y-, r- J •— 


] 


Details 

u t - ^ ^ ^ f wao dUVibea DV b bA I 

° f Cu f° ms and Immigration and Enforcement that the United 
States Secret Service (USSS)had a hired a third party to review the 

aUeaeSv Pr thr b ^ PTE 9 H of Quincy, Massachusetts and that 
llegedly, the results of the review indicated that there was an n q 
inf rasturcture weakness related to the software. At the tSI only a' 
small number of details were available, they did not include who had 
conducted the review and the results of the review Mditionallv it 
bSe 1 "^^ P ? e USSS WaS n0t inclined to share the resuUs with' 
captioned cLe P criminal investigative team invovled in 

to ohf,' Since : that time, efforts have been made on various fronts 
to obtain mor? in formation . from the USSS. On August 14, 2003, SSA 

1 y er Division successfully obtained both referenced 


bo 
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To: Boston From: Boston 

Re: 265C-BS-90861, 08/14/2003 


?h?iH SUre f' Through L □ efforts, it was learned that the 

pen y review of PTECH's software was conducted by the CERT 

Sc«eS a at°?h?^ r - CE ? T iS the C ° mputer ^ mer 9 enc y Response Team 
locatedat the Software Engineering Institute at Carnegie Mellon 

entity Slty in Plttsburgh ' Pennsylvania. CERT is a federally funded 

sumraarizps^FRT - f f , e " closure ' , the undated to Senator Charles Grassley 

?i| nqs ag i t relates to their review of PTECH's 


b6 

blC 


^ware. Ac f ord t ng , to L | the letter was mailed to'senator 

clear tLit^FRT 1 ^ 1 l' > ^ ' ' J n GERT ' s let ter to the Senator, it is 
lear that CERT was tasked with determining whether or not the 

°^ ar % condained malicious code or "back doors" that may disclose an 
■f q lzat ion s sens itive information to outsiders. CERT's evaluation 
H .^ n no evidence of backdoors or other malicious code. Further CERT 
v^lH°L belleVe K5 hat fUrther technica l analysis of the sof twarfwoulS 

PTECH S ; should be noted that CERT did opine that if 

lntare sted in gaming a detailed understanding of its 

software P ?M* 10nS '. lt: W ° U i d n0t need to inst all backdoors on its 
thlv Ci opinion is based on CERT's assessment tha t because as 
they cite. According to the whistleblower I “ I it w =<, 

common practice for the consultants to take copies of the resultina 
databases back to their office to perform additional work." 

CERT's i a o Pf LD C0MME * TT : is useful to note that with respect to 

to indicate aa ®® ssment ' 5° definitive evidence has been found to date 

or sensit^P^S/P" 6 fr ? m PTECH ' s improperly collected proprietary 
ensitive data from a client and brought it back to PTECH and then 

CE R^! r , tranS F ferred °P Side ° f PTECH to unauthorized Xl S 
CERT s commentar y m this area ap pear s to be h^ seH on 
interaction with I v hi 
JP MORGAN CHASE in 2002. [ 


thatf 


3 


was working with her at 


■GibLef complaint on 05/2 2/2002 was 

Jand [ * 


, 1 . i iQUU I 

arrived at JP MORGAN with a laptop computer which he wan 
M0RGAN computer network. According 


]at Ptech 


ed to connect 

Lraditmnal method is to bring diskettes for such In eval uation, and 

— as not allowed to connect his laptop into the JP MORGAN 

computer network for fear that he would download 

Do^h?U? n his lapt op. I I felt that therS til l glia 

possibility thatQ_ , ^conducted this scam with ofhar 

customers, but she had no proof. I n| J OW n words, over 14 months 

she was not able to state that \ ]-R ‘ 


lad actually done anything 


ago, 

° r c °mmitted any crime. Yet she was able to speculate~that 
there was a good possibility that he conducted a scam with other PTECH 
out SaVP^ a p dence of an V kind. It is further worth pointing 
haL £ dUr i n 5 tbe course of the captioned investigation, Sitnessls 
Srcliln? daS W ?h^f r h they K Were auara ° f unauthorized tandUng 
like ihS oScuired? "° r9Sponses suggesting a situation 


2 




To: Boston From: Boston 

Re: 265C-BS -90861, 08/14/2003 


Terrorist Links e to n ptPoh 10 ? Ure, ^ o hite paper entitl ed; "Possible 
n T . tech, Inc., a U.S. Company" was prepared by CERT 

ell, It— appe ars to be prepared primarily based 6 n information 

should more aptly be described as sheer speculation on the part of 

both document s!' riter rec0I ™ ends a11 teceiying parties closely review b6 

b7C 


were not subs Wnr-ia I 1 h ■ I assessme; nt was that the conclusions by CERT 
were not substantially different from CYBER's oriqinal assessment that- 

srftSaS? n ° evidence o£ backdoors or malicious c?de within the 


r 


Attorney 


SQth documents . have be en made avai lable to Assistant US 

"L? nd SA I i , I BICE. Furthermore, SSA 


6 and TFOS . 


i „ . , 7 _ I DicL. turrnermore, SSA 

J has provided copies of the documents to ITOS 1/CONUS 2/TEAM 


Boston's investigation continues. 


♦♦ 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


Date: 09/3/2003 


Boston Attn: SSA 

(pt-cm 

saT 

If CT-3 ) 

sa£ 

1 

SSA 

Counterterrorism Attn: SSA 

1 l(CT-l) 



CONUS II/ITOS 1. rnnm R970 

sc I 

TFO 

Office of Public Affairs Attn: SSA 

. room 4R71 


Congressional Affairs Office 
Room 7240 


From: Cyber 

CIS/C3lU/room 5931 

Contact: SSAP^ 



Approved By: 
Drafted By: 

1 [ asm 

(U) 

Case ID #: (V) 

'A 1 l-CLASS (Ppndi ml 

[I 

() 2$8B-BS-90939 (Closed) 


> 288B-HQ-1394667 (Closed) 

(U) 

Title : X) 




UBA, FTEUH, INC., 

QUINCY, MASS.. 


AOT - IT - WCC 


,‘TT\ -jr To provide receiving offices with (1) a coov nf 3 

? dln9 1 PTEC S ^ a " d < 2 > a letter addressed Vo 3 
Unive?sit5 cfr? ^rassiey, both prepared by Carnegie Mellon 
university CERT (computer incident response team) . 


<U) 




De rive d From 
Dec 


G-J 


Enclosures : Enclosed for receiving offices is one m 

To Ptfch 1 ™!^ 9 "a i U 1 S d 'c " Whit » PaPer: Possible Terrorist links 
CERT ana 7??U U ' 2 ' Company”, prepared by Carnegie Mellon 

Carn^gS M ilion ?L? f ,not 5atJd 3ddreSSed t0 Senat ° r Grass1 ^ fbb ”> 


b6 

b7C 


b7A 



(U) 





ton From: 


Cvh.er 
(-CLASS, 


09/3/2003 


hi A 


(U) 


Details : 


(U) 


-7/oo/oaa-, DUbLOO 

1 / 2 . 3/2003, and telcall s between SSA 
Boston, and SSA | | ITOS/CTD. 


R efere nce Boston EC to Counterterrorism dated 

alls hdf-T.rQQn C O 7\ I I , 


C3lU/CyD, SA[ 


8712/2003, A/scf 

the /’wllr.v rv 2 ! _ T 


the inf 9gmg tion of receiving offices, on 

Secret Service detailee to 


the Cyber Division, FBIHQ) , Computer Intrusio^Section^CIS) 
obtained the enclosed White Paper from the USSS connrp 
affairs office, Washington D.C. A/SCl UrivbpH 

P ttsb" a^%r e r red 7 , the CERT ' 

burgh, PA. pursuant to a request from Senator Chari pq Y 

Grassley's office thru OSSS. He idvised that See? was^Suested 

with°Senator e GMsslL' na - ySi ? of Pteoh in connection 

hvS.r? at °5 G f assley s in quiries into the possible threat nosed 
by Ptech and its product/services due to its alleged coSnec?ions 

Lassley’s S office P sta?? indi ^ iduals • advised that Senator 
once the Sert ^ , re qu e sting a meeting with the FBI 

review Sp ° rtS are completed and provided to the FBI for 


b6 

b7C 


(U) Pittsburoh^niTH 8/ ^ /2003, throu qh Cyber Division/CCIU and 
(U) Pittsburgh Division liaison with Carnegie Mellon CERT CERT 

?ECT ld 1 h C ° f 3 l8tter addressed Co SenatCC GL”slCy R £rom 

S T ’ FR l h ® letter was pursuant to Senator Grassley’s request for 

^e C of4 0 c“C SOft T a re for evidence of’mSici™, 

conclusions whiCHn e.^S&.S^^^^aluation 

"fCrthCC e e v7Sa n t C fon° f oC a Ch kd00r t 0r ° ther ,nalicious =°de and that 
CERT advise a CL a 7CL 0 L«Cr 3 „°a f r?o r ™C^d n0t yl,ld n ” 

referenced ‘Ciad^ompHtCl thS ab ° V<i ' C3IU/CyD ” 131 consider the 


LEAD (S) : 



2 




b7A 


(U) 


To: 

Re: 



Boston From: Cvber 

M 


CLASS, 


09 / 3/2003 


Set Lead 1: (Info) 

BOSTON PTVTSTnN 
AT BOSTON. MASSACHUSETTS 
(U) Read and clear. 

Set Lead 2: (Info) 

COUNTERTERROR TSM 
AT WASHINGTON r> . C 

(U) Read and clear. 

Set Lead 3: (Info) 

OFFICE OF PUBLIC AFFATRS 
AT WASHINGTON n r 
(U) Read and clear. 



3 



SECRET 


To: Boston From: Cyber 

(U) Re: 2 65C-BS- 908 61-CLASS, 09/3/2003 

Set Lead 1 : (Info) 

BOSTON DIVISION 
AT BOSTON , MASSACHUSETTS 
(U) Read and clear. 

Set Lead 2: (Info) 

COUNTERTERRORISM 
AT WASHINGTON D.C. 

(U) Read and clear. 

Set Lead 3: (Info) 

OFFICE OF PUBLIC AFFAIRS 
AT WASHINGTON D.C. 

(U) Read and clear. 
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04/11/03 

10:12:30 

Case ID: 288B-HQ-1394667 
Serial : 6 


DECLASSIFIED BY 60324 UCBAW/SAB/SBS 
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*** WARNING *** City isn't covered by the office which the lead is 





RET/NOFORN/ORCON 


DATE: 06-22-2011 
re I INFO. 

CLASSIFIED BY 60324 UCBAW/SAB/SB 
REASON: 1.4 (c) 

DECLASSIFY ON: 06-22-2036 


U S. Department of Justice 


Federal Bureau of Investigation 


Washington, D C 20535-0001 

October 28, 2002 


X PTECH INC. - SUBJECT (U.S. COMPANY) ; 

FBI, FAA, IRS, USAF, DOE, OTHER U.S. GOVERNMENT AGENCIES - 

POSSIBLE VICTIMS; 

TARGETING THE NATIONAL INFORMATION INFRASTRUCTURE - 
COUNTERINTELLIGENCE/COUNTERTERRORISM (TNII-CI/CT) 

FILE #288B-HQ-1394667 


(U) Full Field Investigation instituted: 8/23/2002 




- Since June 1995, the Boston FBI Counterterrorism 

(CT) squads have been investigating several individuals who 
have had numerous contacts and associations with persons and 
groups suspected of ties to international terrorism. Sotur of 
these individuals include I 

Jand | "" I 

nd l I are associated, as 

Inc. (Ptech), Quincy, 
Massachusetts, a computer software company. Source reporting 
and the Ptech Internet website have listed the FBI, FAA, IRS, 
USAF, DOE, and other U.S. government agencies as Ptech 
customers. Source information has also reported that Ptech 
may have done business with the White House and/or the Vice 
President's office, under the auspices of another company 
named Process Renewal Group ( PRG) . 


qgSCTTPgTr bei ' aw, OTTTT Ptech 


] 


(U) Ptech Inc. is a business involved m providing 
enterprise architecture and business modeling, analysis and 
integration solutions to Global 2000 companies. This 
technology addresses every aspect of the organization, from 
strategic planning, to business architecture; from business 
processes to network, supporting applications, and all forms 
of information, which is integrated to form a complete 
representation of the company's knowledge. Massachusetts 
State corporate records list Ptech Inc. as a partnership, its 
business address as 160 Fede ral Street, Boston, MA. 02110. and 
Its I land I a j * V | 

I The records further references 
dii TTTVUTUTTTTnry diasuiutlbh bite of 8/31/1998, and a subsequent 

v - cM&B-HQ- IS qMGjIol- 4 

Sta^/NOFORN/ORCOlO > 


be 

b7C 



J^JB^T/NOFORN/ORCON 


revival date of 6/1/2001. Lexis/ Nexis cherlcs of Pte>rH j i Qh 

,thft ooninanv ' s nthpt; principals as 

i 1 i 1 and i i 

3^4. On 6/27/1995. FBI Boston opened a preliminary 

inquiry (PI) on based on his telephone contacts with 

the Holy Land Foundation for Relief and Development (HLFRD) , 
Dallas, Texas. HLFRD is an organization suspected of being a 
source for funding terrorist activities and groups. 

J^NF/OC) Investigation of I . I had also revealed 
that he had telephone contacts with| [subjects and was 

associated with other Boston international terrorism subjects. 

A Full Field Investigation ( FFI ) (199N-BS-77139) was initiated 
by FBI Boston on 6/11/2002. 

Source information has indicated that l l and 

other Ptech employees traveled to Saudi Arabia, during 
Febr uary 1999, to seek funding from a wealthy Saudi Arabian 
name l l Sources have also 

reported that | | may have been the source of aooroximatelv 

$16 million in startup funds for Ptech. |"^ lhas been 
described as one of the "chief money launderers" for OSAMA BIN 
LADEN . 


• $8$ Source rep orting has indicat ed that another 

indivi dual, ! I is associated with I l and Ptech. 

I 1 is reported to be a Pakistani National on the Ptech 

Board of Directors. | 1 is also the head of SAAR 

Foundation, Herndon, vA. This foundation has been linked to 
financial organizations that are being investigated for 
handling large sums of money to fund activities for OSAMA BIN 
LADEN and various other terrorist organizations. SAAR is the 
subject of a U.S. C ustoms Service (USCS) /Joint Terrorism Task 
Force (JTTF) case. | I is a central figure in this 

investigation. Searches of the offices of SAAR Foundation, 
and other foundations in the Northern Virginia area, were 
conducted by federal agents during March 2002, m connection 
with the USCS/JTTF investigation. 


^NF/OC) r 

is a compute 


1 


, , . . a U.S. per son, is 

employed as a computer software engineer for Ptech, 
also serves as the current president and as a long-time mer 
of CARE INTERNATIONAL, a non-governmental organization m 


er json. i.s 
-time member 


Boston with ties to international 
funding for terrorist activitie 
FBI Boston FFI (199N-BS-86457) 






t error! 


;m and as a source of 


£ 
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^^Sl^WOFORN/ORCON 


(S) I 

I I This investigation has 

1 itivydiya that CAKE INTERNATIONAL serves as a front for 

recruiting local Muslims to participate in international jihad 
effort . 


(U) 


(U) 


(U) 


£&^NF/OC) I , | | is an employee of Ptech 

Inc., in Boston, and is the I End ■ iof 

Care International, a non-governmental organization m Boston 
with ties to international terrorism. Care International was 
previously known as the Al-Kifah Refugee Center of Boston. 
Following the World Trade Center attack in 1993, Al-Kifah 
changed its name to Care International after the media 
reported that members of the Al-Kifah Refugee Center of New 
York were involved in the attack. In the Boston area. Care 
International has served as a front for recruiting/funding 
local Mu slims to pa rticipate m the internati onal Jihad 
eff orts. | 1 is closely associated with| i 

the | { of Care International. 

M 0n May 28, 2002, a complainant working for JP 
Morgan Chase in Manhattan, NY, reported suspicious business 
practices by Ptech. This complainant was concerned that Ptech 
was involved m the theft of technology fr om U.S. companies. 
This complainant advised that is connected to 

organizations which provide funding tor terrorist purposes. 
This complainant further indicated that a Ptech employee may 
have tried to gain access to the Chase network during a 
demonstration of Ptech products and/or services, although 
there is no independent information to corroborate this. 

^ On August 23, 2002, it was determined that the 

Information Resources Management { IRM) Office, FBIHQ, had 
purchased Enterprise Architecture computer software from Ptech 
m early 2001. This software, named "Framework," was being 
used as a management tool on the FBI's intranet network and is 
used for the FBI Enterprise Architecture project. The 
software allows users to access the FBI’s Strategic Plan, 
organization chart, business processes, and other 
applications. 


M Ptech Framework software originals and copies 

..-including updated versions and "accelerators" were provided to 
the Counterintelligence Counterterrorism Computer Intrusion 
Unit (C3IU) , Cyber Division, by IRM for technical analysis. 
Preliminary technical analysis of the Ptech software by the 
Special Technologies and Applications Unit (STAU) to date has 
not revealed any evidence of malicious (eg. trojans. 


b 

b 
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backdoors, viruses, worms, etc.) orSany other' unauthorized 
code imbedded m the software. Examination of two IRM 
computers used to run the software has not revealed any 
abnormalities. According to IRM, the Ptech software was not 
used to connect to the FBI computer network. ■Referral/ Consult 



" IRM personnel (section chief., chief architect, 

computer scientist, contractors) who worked with the Ptech 
software on the FBI Enterprise Architecture project have been 
interviewed. These individuals had no direct contacts or 
dealings with Ptech or its personnel with the exception of 
receiving training from instructors from Ptech. The reason 
is that the Ptech software purchased by the FBI was actually 
purchased through a government contractor called SPAWAR (Space 
and Naval Warfare) . 


M C3IU has obtained documents from IRM and the 
Contracts Unit that relate to the FBI purchase of the Ptech 
software. The documents indicate that during 12/2001, the FBI 
purchased two licensed copies of the Ptech Framework software, 
including updates and accelerators, for use m developing the 
FBI's Enterprise Architecture (EA) at a cost of $15,000. The 
purchase was actually made by SPAWAR on behalf of the FBI and 
pursuant to the SPAWAR contract. 


The FBI New York Cyber squad has advised that 

they have been working with the security department of JP 
Morgan Chase Bank, NY, concerning Ptech' s efforts to market 
their software to the bank. JP Morgan security advised that c 
Ptech representative was allowed limited access to the 
company's network for this purpose. JP Morgan Chase Bank 
security conducted a thorough search of all areas of their 
network accessed by the Ptech representative but did not find 
any abnormalities. They advised that during a Ptech software 
demonstration at JP Morgan Bank, JP Morgan denied the Ptech' s 
representative's request to connect his computer with the 
company’s network. As a result of the above dealings with 
Ptech, JP Morgan did not purchase software from the company. 




J/NOKORN/ORCON 
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(UJ 


. K Source information and public records have 

indicated that the Process Renewal Group ( PRG) is a consulting 
group out of Vancouver — Rriti eh .Columbia, Canada. A former 
Ptech Inc. employee, I I was once employed by PRG. 

Source information has further indicated that PRG never had a 
contract with the White House as has been claimed bv Ptech 
advertisements and is believed to be fabricated by | ~~| and 
others for the benefit of Ptech. The Contracts Unit, Finance 
Division, FBIHQ, advised that they failed to locate any 
records of doing business with PRG. 


(S) 


W The FBI Boston' g nniin1-Sr)-orr- ft ri orm 

| has not developed any inrormation or indications 
"i-ucic i lclii ii'as been involved in the installation of any 
malicious or unauthorized code or backdoors into the FBI or 
other government networks, either through their software or 
services. 


(U) 


X The FBI Boston Division Cyber squad has been 

working closely with the Boston Counterterrorism squads to 
coordinate the investigations of Ptech and its principals. 
Boston's Cyber squad m conjunction with FBIHQ, will evaluate 
the extent and nature of the threat to the national 
information infrastructure posed by Ptech Inc. and its 
principals and employees. 


(Sh 
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JE positive informa tion was discovered J * 


\ 


Ml positive information was obtained 


information was obtained. 


positive 


IRM conducted a canvass of all FBI divisions to 
determine if any other Ptech products were being used or had 
been acquired. The results of the canvass determined that no 
one else m the FBI reported acquiring or using any Ptech 
products. IRM and the FBI has discontinued the use of the 
Ptech Framework software and a decision has been made not to 
acquire or use Ptech products m the future. 

(SI i =J 


I f . n purpnoa 

these ^ interviews would be to obtain information concerning 
Ptech s involvement in planting malicious code or unauthorized 
code in their software or efforts to implant them m U.S. 
computer networks. 

-Referral /Con suit 

(U) Investigation continuing. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence : ROUTINE 


Date: 08/24/2002 


To: Counterterrorism 

Boston 


Attn: 


SSA 

SSA 


1 - UBLU 

==□ 


From: Cyber Division 

C3IU/CIS/#5931 
Contact: SSA I 


Approved By: 


be 

fo7C 


Drafted By: I l asm 

(U) Case ID #: (X) 288B-NEW (Pending) 

jUj --Title: PTECH INC - SUBJECT (A U.S. COMPANY); 

FBI, FAA, IRS, USAF, DOE, OTHER U.S. 
GOVERNMENT AGENCIES - POSSIBLE VICTIMS 
TARGETING THE NATIONAL INFORMATION 
INFRASTRUCTURE - COUNTERINTELLIGENCE/ 
COUNTERTERRORISM (TNI I- Cl /CT) 

OO. HQ 


(U) 


Synopsis: Initiation of Full Field 

captioned matter. 


Investigation 


(FFI ) 


on 


(U) 

(U) 


Derived^gcogt^T G-3 
DecAa^sify OnT — Ki. 


<TJ) M 

Full Field Investigation Instituted: 8/23/2002 

Details : Since June 1995, the Boston FBI counterterrorism 
squads have been investigating several individuals who have had 
numerous contacts and associations with persons and groups 
suspected of ties t o international terrorism. Some of Miprp 

..individuals ^nciudei i 


.s im-li 
| anq 
i, as a? 


associated, as cfs&£i*ibed below, 

Massachusetts, a computer software company. 


with Ptech 


] and | are 

(Ptecn; , Quincy, 


Inc . 

- -jr~- ^ • Source reporting and 

the Ptech Internet website have listed the FBI, FAA, IRS, USAF, 

DOE, and other U.S government agencies as Ptech customers. Source 


^S^ef/ORCON/NOFORN 


' w© -i^q ui~l 
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IT/ORCON/NOFORN 


To- Counterterrorism From. Cyber Division 
Re: £&£ 288B-NEW, 08/24/2002 


information has also reported that Ptech may have done business 
with the White House and/or the Vice President's office, under the 
auspices of another company named Process Renewal Group (PRG) . 


I 


Mr<ai-h ' i n 


„ Corporate records list | | as th. 

j for Ptech. According to these records, I 
' -| He has been described as the| 

Jbehind this entity. 


L 




*1 esf ab 


and 
_ished 
] and 


>3 

inquiry (PI) 


Qn fi/2j 7/1995, FBI Boston opened a preliminary 
on l I based on his telephone contacts with the 

Holy Land Foundation for Relief and Development (HLFRD) , Dallas, 
Texas HLFRD is an organization suspected of being a source for 
funding terrorist activities and groups. 

,>;/NF/0C) Investigation of I l had also revealed that 

he had telephone contacts with HAMAS subjects and was associated 
with other Boston international terrorism subjects. A Full Field 
Investigation (FFI) (199N-BS-77139) was initiated by FBI Boston on 
6 / 11 / 2002 . 


Source information has indicated that land 

other Ptech employees traveled to Saudi Arabia, duriW~ T UUZuarv 
1999, to seek funding from a wealthy Saudi Arabian name I I 

aka l I Sources have also reported that l I may have 

been the source of approximately $16 million in startup funds for 
Ptech. I | has been described as one of the "chief money 
launderers" for OSAMA BIN LADEN. 

M) Source re porting has indicated that another 
individual, | ~ is associated with l I and Ptech. | | 

is reported to be a Pakistani National on the Ptech Board of 
Directors. I I is also the } j SAAR Foundation, Herndon, VA. 

This foundation has been linked to financial organizations that are 
being investigated for handling large sums of money to fund 
activities for OSAMA BIN LADEN and various other terrorist 
organizations. SAAR is the subject of a U.S. Customs Service 
(USCS) /Joint Terrorism Task Force ( JTTF) case. | |is a central 

figure in this investigation. Searches of the offices of SAAR 
Foundation, and other foundations in the Northern Virginia area, 
were conducted by federal agents during March 2002, in connection 
with the USCS/ JTTF investigation. 

fc^NF/OC) I I 3 U.S. per son, is 

employed as a comput er software engineer for Ptech. | ( also 


serves as the current^ 


^ ^ — — *— ^ w-** . | | 

Jand as a long-time member of CARE 


^JR^RET/ 
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£T/ORCON/NOFORN 

To: Counterterrorism From- Cyber Division 

"Ret £S< 288B-NEW, 08/24/2002 


(S) 


INTERNATIONAL, a non-governmental organization m Boston with ties 
to international terrorism and as a source of funding for terrorist 
activit ies. | I is the subiect of a FBI Boston FFI (19QN -R.q- 


fc7C 




bl 


I This invesMaat-lon hag yoirfla 1 
INTERNATIONAL serves as a front for recruiting local Muslims to 
participate m international jihad efforts. 


On August 23, 2002, Section Chief Mark Tanner, 

(U) Information Resources Management (IRM) Office, FBIHQ, advised that 

the FBI had purchased Enterprise Architecture computer software 
from Ptech in early 2001. This software, named "Framework," is 
currently being used as a management tool on the FBI 1 s intranet 
network and is used for the FBI Enterprise Architecture. The 
software allows users to access the FBI's Strategic Plan, 
organization chart, business processes, and other applications. 

----- The Cyber Division is working with the IRM Office to 

(U) conduct a thorough technical analysis of the Ptech software to 

determine if the software poses a threat to the FBI network or can 
be utilized to install a backdoor for later access. The analysis is 
a two pronged approach. First, an analysis of the software 
computer compact discs to determine if the software installed any 
malicious or unauthorized code into the FBI networks, or provides a 
backdoor to these networks. As of 8/24/2002, preliminary 
technical analysis of the compact discs conducted by Crucial 
Security, Special Technology and Applications Unit (STAU) , has 
not revealed any abnormalities. The second phase is to monitor, at 
the network level, the computer server where the Ptech software 
currently resides, to look for any anomalous activity of that 
server with the FBI networks Crucial Security is currently 
conducting this type of analysis. ” ' 

(S) [ 


(S) While this analysis of the software and the server's 
relationship with the FBI network is being conducted, efforts are 
ongoing to fully identify all anvprnniPnt- aistXMHfiXa ^ Bfcach 


Referral/ C o nsul t 
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S^S^ET/ORCON/NOFORN 

To: Counterterrorism From: Cyber Division 

Re: X 288B-NEW, 08/24/2 002 


(U) 


(U) 


(S> 


O n May 28, 2002, a complainant working for JP Morgan 
Chase m Manhattan, NY, reported suspicious business practices by 
Ptech. This complainant was concerned that Ptech was involved in 
the theft of technology from u.S companies This complainant be 

advised that ) 1 is connected to organizations which fo'/c 

provide funding for terrorist purposes. This complainant further 
indicated that a Ptech employee may have tried to gain access to 
the Chase network during a demonstration of Ptech products and/or 
services, although there is no independent information to 
corroborate this. 

. . . The FBI Boston '.s„^ounterterr 2 r^s^ mmstigation to b: 

. te rF |has not 
develbpea-any luiciniation ’ CT lhdidations that Ptech has been 
involved in the installation of any malicious or unauthorized code 
or backdoors into the FBI or other government networks, either 
through their software or services. 


' The FBI Boston Division Cyber squad has been working 

(U) closely with the Boston Counterterrorism squads to coordinate the 

investigations of Ptech and its principals. Boston's Cyber squad 
m conjunction with FBIHQ, will evaluate the extent and nature of 
the threat to the national information infrastructure posed by 
Ptech Inc. and its principals and employees. 
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To. Counterterrorism From: Cyber Division 

Re: 288B-NEW, 08/24/2002 


LEAD ( s ) : 

Set Lead 1; 


COUNTERTERRORISM 


AT WASHINGTON . nr 

^3^ UBL Unit is requested to continue close coordination 
with the Cyber Division/C3IU concerning parallel 199N/288B matters 
regarding Ptech Inc and it's principals and employees. The Cyber 
Division's main focus will be to thoroughly investigate Ptech Inc. 
anc ? individuals associated with the company including its 
principals and employees, who may be involved in designing and 
modifying software and/or performing services for the purpose of 
compromising the networks of their government and non -government 
customers . 

Set Lead 2 : 


BOSTON 

AT BOSTON. MASSACHUSETTS 


3^ Boston Division's Cyber (NIPCIP) Squad is requested 
to initiate a separate 288B matter, to coordinate 

investigations with CT-1 squad (SSa| 


♦♦ 
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